Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
CVE Intelligence

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

All Critical Actively Exploited Remotely Exploitable
Last Updated Published CVSS Score
Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-5365 — LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellati…

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 5.3.2. This is due to missing nonce verification on the request_cancellation() funct…

Remote | Cross-Site Request Forgery
May 14, 2026 May 14, 2026
May 14, 2026
May 14, 2026
6.5 MEDIUM
CVE-2026-5193 — Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authen…

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insu…

essential_addons_for_elementor | Remote | Authorization
May 14, 2026 May 14, 2026
May 14, 2026
May 14, 2026
8.1 HIGH
CVE-2026-3892 — Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbit…

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.4.107. This is due to insufficient file …

motors_-_car_dealer\,_classifieds_\&_listing | Remote | Path Traversal
May 14, 2026 May 14, 2026
May 14, 2026
May 14, 2026
7.2 HIGH
CVE-2026-3718 — ManageWP Worker <= 4.9.31 - Unauthenticated Stored Cross-Site Scripting via 'MWP-Key-Name…

The ManageWP Worker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'MWP-Key-Name' HTTP request header in all versions up to, and including, 4.9.31. This is due to insuffici…

Remote | Cross-Site Scripting
May 14, 2026 May 14, 2026
May 14, 2026
May 14, 2026
6.4 MEDIUM
CVE-2026-3694 — Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via…

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions up to, and including, 5.6.8. This is due…

bold_page_builder | Remote | Cross-Site Scripting
May 14, 2026 May 14, 2026
May 14, 2026
May 14, 2026
Showing 20 of 6965 Results